Set optional peername when X509_check_host() succeeds.
Pass address of X509_VERIFY_PARAM_ID peername to X509_check_host().
(Imported from upstream's 55fe56837a65ff505b492aa6aee748bf5fa91fec.)
Change-Id: Ic21bfb361b8eb25677c4c2175882fa95ea44fc31
diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c
index 29a2545..5195019 100644
--- a/crypto/x509/x509_vfy.c
+++ b/crypto/x509/x509_vfy.c
@@ -713,7 +713,8 @@
for (i = 0; i < n; ++i)
{
name = (unsigned char *)sk_OPENSSL_STRING_value(id->hosts, i);
- if (X509_check_host(x, name, strlen((const char*) name), id->hostflags) > 0)
+ if (X509_check_host(x, name, strlen((const char*) name), id->hostflags,
+ &id->peername) > 0)
return 1;
}
return n == 0;
diff --git a/crypto/x509v3/v3_utl.c b/crypto/x509v3/v3_utl.c
index a85a2a6..76ee8ae 100644
--- a/crypto/x509v3/v3_utl.c
+++ b/crypto/x509v3/v3_utl.c
@@ -851,8 +851,11 @@
static int do_check_string(ASN1_STRING *a, int cmp_type, equal_fn equal,
unsigned int flags,
- const unsigned char *b, size_t blen)
+ const unsigned char *b, size_t blen,
+ char **peername)
{
+ int rv = 0;
+
if (!a->data || !a->length)
return 0;
if (cmp_type > 0)
@@ -860,27 +863,30 @@
if (cmp_type != a->type)
return 0;
if (cmp_type == V_ASN1_IA5STRING)
- return equal(a->data, a->length, b, blen, flags);
- if (a->length == (int)blen && !memcmp(a->data, b, blen))
- return 1;
- else
- return 0;
+ rv = equal(a->data, a->length, b, blen, flags);
+ else if (a->length == (int)blen && !memcmp(a->data, b, blen))
+ rv = 1;
+ if (rv > 0 && peername)
+ *peername = BUF_strndup((char *)a->data, a->length);
}
else
{
- int astrlen, rv;
+ int astrlen;
unsigned char *astr;
astrlen = ASN1_STRING_to_UTF8(&astr, a);
if (astrlen < 0)
return -1;
rv = equal(astr, astrlen, b, blen, flags);
OPENSSL_free(astr);
- return rv;
+ if (rv > 0 && peername)
+ *peername = BUF_strndup((char *)astr, astrlen);
}
+ return rv;
}
static int do_x509_check(X509 *x, const unsigned char *chk, size_t chklen,
- unsigned int flags, int check_type)
+ unsigned int flags, int check_type,
+ char **peername)
{
GENERAL_NAMES *gens = NULL;
X509_NAME *name = NULL;
@@ -889,6 +895,7 @@
int cnid;
int alt_type;
int san_present = 0;
+ int rv = 0;
equal_fn equal;
/* See below, this flag is internal-only */
@@ -924,7 +931,6 @@
gens = X509_get_ext_d2i(x, NID_subject_alt_name, NULL, NULL);
if (gens)
{
- int rv = 0;
for (i = 0; i < sk_GENERAL_NAME_num(gens); i++)
{
GENERAL_NAME *gen;
@@ -939,16 +945,14 @@
cstr = gen->d.dNSName;
else
cstr = gen->d.iPAddress;
- if (do_check_string(cstr, alt_type, equal, flags,
- chk, chklen))
- {
- rv = 1;
+ /* Positive on success, negative on error! */
+ if ((rv = do_check_string(cstr, alt_type, equal, flags,
+ chk, chklen, peername)) != 0)
break;
- }
}
GENERAL_NAMES_free(gens);
- if (rv)
- return 1;
+ if (rv != 0)
+ return rv;
if (!cnid
|| (san_present
&& !(flags & X509_CHECK_FLAG_ALWAYS_CHECK_SUBJECT)))
@@ -962,20 +966,22 @@
ASN1_STRING *str;
ne = X509_NAME_get_entry(name, j);
str = X509_NAME_ENTRY_get_data(ne);
- if (do_check_string(str, -1, equal, flags, chk, chklen))
- return 1;
+ /* Positive on success, negative on error! */
+ if ((rv = do_check_string(str, -1, equal, flags,
+ chk, chklen, peername)) != 0)
+ return rv;
}
return 0;
}
int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,
- unsigned int flags)
+ unsigned int flags, char **peername)
{
if (chk == NULL)
return -2;
if (memchr(chk, '\0', chklen))
return -2;
- return do_x509_check(x, chk, chklen, flags, GEN_DNS);
+ return do_x509_check(x, chk, chklen, flags, GEN_DNS, peername);
}
int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen,
@@ -985,7 +991,7 @@
return -2;
if (memchr(chk, '\0', chklen))
return -2;
- return do_x509_check(x, chk, chklen, flags, GEN_EMAIL);
+ return do_x509_check(x, chk, chklen, flags, GEN_EMAIL, NULL);
}
int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
@@ -993,7 +999,7 @@
{
if (chk == NULL)
return -2;
- return do_x509_check(x, chk, chklen, flags, GEN_IPADD);
+ return do_x509_check(x, chk, chklen, flags, GEN_IPADD, NULL);
}
int X509_check_ip_asc(X509 *x, const char *ipasc, unsigned int flags)
@@ -1005,7 +1011,7 @@
iplen = a2i_ipadd(ipout, ipasc);
if (iplen == 0)
return -2;
- return do_x509_check(x, ipout, (size_t)iplen, flags, GEN_IPADD);
+ return do_x509_check(x, ipout, (size_t)iplen, flags, GEN_IPADD, NULL);
}
/* Convert IP addresses both IPv4 and IPv6 into an
diff --git a/crypto/x509v3/v3nametest.c b/crypto/x509v3/v3nametest.c
index b2e9c09..b38df97 100644
--- a/crypto/x509v3/v3nametest.c
+++ b/crypto/x509v3/v3nametest.c
@@ -333,7 +333,7 @@
memcpy(name, *pname, namelen);
ret = X509_check_host(crt, (const unsigned char *)name,
- namelen, 0);
+ namelen, 0, NULL);
match = -1;
if (ret < 0)
{
@@ -352,7 +352,8 @@
check_message(fn, "host", nameincert, match, *pname);
ret = X509_check_host(crt, (const unsigned char *)name,
- namelen, X509_CHECK_FLAG_NO_WILDCARDS);
+ namelen, X509_CHECK_FLAG_NO_WILDCARDS,
+ NULL);
match = -1;
if (ret < 0)
{
diff --git a/include/openssl/x509v3.h b/include/openssl/x509v3.h
index a2441fa..dcf105a 100644
--- a/include/openssl/x509v3.h
+++ b/include/openssl/x509v3.h
@@ -714,7 +714,7 @@
#define _X509_CHECK_FLAG_DOT_SUBDOMAINS 0x8000
OPENSSL_EXPORT int X509_check_host(X509 *x, const unsigned char *chk, size_t chklen,
- unsigned int flags);
+ unsigned int flags, char **peername);
OPENSSL_EXPORT int X509_check_email(X509 *x, const unsigned char *chk, size_t chklen,
unsigned int flags);
OPENSSL_EXPORT int X509_check_ip(X509 *x, const unsigned char *chk, size_t chklen,
